AI identity control in the browser is the new governance gap

At a glance

What this is: This is a thought leadership post arguing that browser visibility and control are now central to defending identity, AI app usage, and unmanaged access paths.

Why it matters: It matters because IAM teams can no longer treat the browser as a presentation layer only, since credential theft, session hijacking, shadow SaaS, and AI access all converge there.

👉 Read Push Security's analysis of why browser security is central to identity control

Context

Browser security is no longer just an endpoint concern. In identity-led attacks, the browser is where credentials are entered, sessions are established, and malicious redirects, lookalike pages, and token theft often succeed before traditional controls have useful context.

For IAM and NHI teams, that changes the operating model. A browser can now be the enforcement point for human authentication, unmanaged identity access, shadow SaaS discovery, and AI app control, which means governance has to follow the session rather than assume the perimeter has already done the job.

Key questions

Q: How should security teams stop credential phishing that bypasses email and endpoint controls?

A: Use browser-layer controls that can see the login page, the user interaction, and the redirect chain in real time. That lets teams block cloned pages and suspicious submissions before the attacker captures the account. The goal is to stop compromise where the credential is entered, not after a token or session has already been stolen.

Q: Why do browser-based attacks create problems for IAM programmes?

A: Browser-based attacks shift identity risk into the place where users authenticate, approve access, and interact with connected apps. IAM programmes that only watch the IdP miss consent abuse, extension-based data capture, and session theft. Teams need browser-layer visibility to understand the real path from login to compromise.

Q: What do organisations get wrong about AI spend visibility?

A: They often confuse partial dashboard coverage with complete governance. A view of one provider or one team can look authoritative while missing direct API keys, unmanaged agents, or cloud workloads that still spend money outside the control point. The right test is whether the control sits in front of the actual estate, not just the easiest part of it.

Q: How do browser controls and endpoint detection work together?

A: Browser controls catch the identity interaction at the point of login or consent, while endpoint tools provide device context, persistence checks, and broader threat investigation. Used together, they close the gap between what the user sees and what the endpoint can prove. That combination is stronger than relying on either layer alone for account takeover prevention.

Technical breakdown

Why browser telemetry matters for identity attacks

Browser telemetry captures what users actually see and do inside the session, including login page rendering, form submission, redirects, and suspicious in-browser behaviour. That matters because credential phishing, adversary-in-the-middle attacks, and session hijacking often succeed without tripping email or endpoint signals first. The browser can expose the exact point where a legitimate user crosses into a malicious workflow, which is why it is increasingly the only layer that sees both the identity action and the delivery method.

Practical implication: collect browser-level signals for login and session events where identity compromise is a primary risk.

How AI apps and shadow SaaS create unmanaged identity paths

AI apps and shadow SaaS introduce access paths that may be initiated by users, embedded in browser sessions, or approved outside formal IAM workflows. These paths often use personal accounts, unsanctioned tools, or browser-mediated auth flows that sit outside standard lifecycle controls. The governance problem is not just discovery, but understanding which identities, sessions, and data flows are now operating outside policy review and access certification.

Practical implication: inventory browser-exposed AI and SaaS usage before trying to govern it through access reviews alone.

Why browser-based controls are different from EDR

EDR observes activity at the device layer, but many identity attacks now terminate inside the browser, where the final credential entry, session capture, or malicious consent action occurs. Browser controls can block the interaction before the account is taken over, rather than detecting damage after the fact. This is especially relevant when attackers use cloned pages, token theft, or deceptive workflows that never look like malware to an endpoint agent.

Practical implication: treat browser controls as a complementary identity enforcement layer, not a substitute for endpoint detection.

NHI Mgmt Group analysis

The browser has become the practical control plane for identity compromise. Credential theft, malicious redirects, token capture, and shadow SaaS all converge in the browser session, which is where users actually authenticate and act. That makes browser-layer telemetry more operationally relevant than many teams have assumed, especially when the attack path never needs to touch the endpoint in a way EDR can easily classify. Practitioners should treat the browser as part of identity enforcement, not just user interface.

Identity programmes built around post-authentication review are lagging the attack path. Once a user has already entered credentials into a fake page or authorized an unsafe app, access governance is reacting too late to stop the initial compromise. The article reinforces a broader industry shift: prevention must happen where identity actions occur, not only where identities are managed. That is a structural change for IAM, IGA, and NHI governance teams.

Shadow SaaS is an identity lifecycle problem, not only a SaaS inventory problem. If users can reach unsanctioned AI tools or unmanaged web apps from the browser, then the issue includes access, approval, data handling, and offboarding. That means the governance model has to cover how access begins, how it is detected, and how it is removed across browser-mediated workflows. Lifecycle discipline now extends into browser-visible application behaviour.

Browser security is becoming a bridge discipline across human IAM and NHI governance. The same session-layer visibility that stops credential phishing can also reveal unmanaged service access, AI app usage, and token-driven interactions that do not fit cleanly into classic IAM diagrams. The field is moving toward shared enforcement points for human users, machine access, and browser-mediated AI usage. Teams that separate those programmes too rigidly will miss the common control surface.

From our research:

• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, which shows the problem is already operational, not hypothetical.
• Browser-layer control and NHI governance now need to move together, as explored in Top 10 NHI Issues, because unmanaged access paths rarely stay isolated.

What this signals

Unmanaged browser access is now one of the fastest routes from identity exposure to account takeover. The practical response is to stop treating browser telemetry as optional visibility and start treating it as part of access governance, especially for SSO, AI tools, and unmanaged devices.

Browser-mediated AI usage should be governed like an identity lifecycle problem. If users can discover, approve, and use AI apps inside the browser without policy linkage, then discovery alone is not enough. Teams need an access model that tracks initiation, consent, and offboarding across the session layer.

As browser control and identity control converge, programme owners should expect more overlap between human IAM, NHI governance, and SaaS risk management. The teams that build shared policy and telemetry now will have a cleaner path to governing AI tools and unmanaged identities later.

For practitioners

• Instrument the browser as an identity sensor Capture login page rendering, redirect behaviour, form submission, and session anomalies so phishing and AiTM patterns are visible at the moment of compromise.
• Map browser-visible AI and SaaS usage Identify unsanctioned AI tools, shadow SaaS, and unmanaged browser-authenticated workflows that bypass normal access review and approval paths.
• Use browser controls for high-risk authentication paths Apply in-browser blocking and warning logic where credentials are entered, especially for SSO, federated logins, and unmanaged device scenarios.
• Align IAM and endpoint telemetry Correlate browser signals with EDR so identity compromise can be detected earlier and investigated with both session and device context.

Key takeaways

• Browser sessions are now a primary control surface for identity compromise, especially where phishing, token theft, and shadow SaaS overlap.
• Training alone does not close this gap, because many attacks succeed at the point where users interact with the browser rather than the endpoint.
• Security teams should align browser telemetry, identity governance, and session controls so account takeover can be interrupted before credential or token capture succeeds.

Key terms

• Browser-based phishing: Browser-based phishing is phishing that executes through the web browser rather than the inbox, often using redirects, malicious sites, consent prompts, or extensions. It matters because the browser is where identity, application access, and session state intersect.
• Shadow SaaS: Shadow SaaS is the set of unauthorised or unreviewed software-as-a-service tools used outside central security governance. These applications often bypass normal identity controls, making them difficult to inventory, monitor, and harden against credential-based abuse.
• Browser telemetry: Browser telemetry is the event data produced by enterprise browser activity, including logins, profile changes, downloads, session starts, and extension or site interactions. In identity governance, it becomes useful when those events are correlated with account state and privilege context rather than treated as generic activity logs.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.

What's in the full article

Push Security's full thought leadership post covers the operational detail this post intentionally leaves for the source:

• How the browser extension observes login pages, form entry, and malicious redirects in real user sessions
• Specific examples of browser-based attack paths that endpoint and email tools often miss
• Practical distinctions between browser security, identity security, and detection workflows
• How the article frames secure AI, shadow SaaS, and unmanaged device protection as browser problems

👉 Push Security's full post covers the browser attack paths, identity gaps, and control implications in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.